Quiz Tool Lite <= 2.3.15 - Multiple Admin+ Stored Cross-Site Scripting

2021-10-1100:00:00

Shivam Rai

297

quiz tool lite

cross-site scripting

multiple admin

stored

email setting

EPSS

0.001

Percentile

24.8%

JSON

The plugin does not sanitize multiple input fields used when creating or managing quizzes and in other setting options, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

1. When creating a new Question Pot, you can inject an XSS payload like  "><script>alert(1)</script> in the Quiz Name.
2. When adding a new quiz, you can inject an XSS payload like  "><script>alert(1)</script> in the Quiz Name.
3. When managing the plugin's Email Setting, you can inject an XSS payload like  "><script>alert(1)</script> in the "And from this name" field.

EPSS

0.001

Percentile

24.8%

JSON

Related for WPEX-ID:F7B95789-43F2-42A5-95E6-EB7ACCBD5ED3